fix backdoor logic and use $_REQUEST for more flexibility